Week of April 21, 2025: CISA's ICS Advisory Wave and CVE Program Reassurance

Security leaders watched CISA publish twelve industrial control systems advisories across two releases, defend the CVE Program against reports of a funding lapse, and detail a joint OT incident-response exercise with DHS S&T, Idaho National Laboratory and Louisiana State University. The week also brought a cluster of CISO moves, including new appointments at F5, Palo Alto Networks, Vaultree and Bedrock Security.

CISA Publishes Seven ICS Security Advisories

On April 24, 2025, CISA released seven industrial control systems advisories covering vendors including Schneider Electric, Johnson Controls, Fuji Electric, ALBEDO Telecom, Vestel, Nice Linear and Planet Technology. The advisories detailed vulnerabilities in products ranging from Modicon controllers to PTP/NTP clocks and EV chargers, along with mitigation guidance for operators of critical infrastructure. For CISOs overseeing operational technology environments, the batch underscored the breadth of exposure across energy, building-access and industrial networking equipment requiring patch review that week. (CISA)

CISA Issues Five More ICS Advisories

Two days earlier, on April 22, 2025, CISA published five additional industrial control systems advisories addressing Siemens TeleControl Server Basic, Schneider Electric's Wiser Home Controller WHC-5918A, ABB MV Drives, and an updated advisory covering Schneider Electric Modicon M580 PLCs, BMENOR2200H modules and EVLink Pro AC chargers. The advisories supplied technical details and mitigations for vulnerabilities across energy and building-automation products, giving security teams another set of OT patch priorities to track alongside the agency's broader April advisory output. (CISA)

CISA, DHS S&T, INL and LSU Run OT Incident-Response Exercise

CISA announced on April 23, 2025 that it had partnered with DHS Science and Technology, Idaho National Laboratory and Louisiana State University to train energy-sector and critical-infrastructure partners against simulated cyberattacks on operational and information technology at the Control Environment Laboratory Resource in Idaho Falls. LSU became the first university invited to join the CELR exercise. CISA's Matt Hartman framed the training as part of an effort to grow operational and strategic partnerships across the OT and industrial control systems community. (CISA)

CISA Moves to Quell CVE Program Funding Concerns

On April 23, 2025, CISA's Matt Hartman issued a statement addressing public reports that the CVE Program faced a funding risk, saying the matter was actually a contract administration issue resolved before any lapse occurred. He noted the program now includes 453 CVE Numbering Authorities and said CISA remained committed to working with MITRE and the CVE Board on incorporating community feedback. The statement sought to reassure network defenders who rely on the CVE Program for vulnerability identification amid concerns about continuity of the federated system. (CISA)

Security Leadership Moves: F5, Palo Alto Networks, Vaultree

SecurityWeek's industry-moves roundup for the week of April 21, 2025 recorded several security leadership changes. F5 named Chris Burger as CISO, drawing on prior roles at Russell Investments and Slalom. Palo Alto Networks named Wendi Whitmore Chief Security Intelligence Officer after she led its Unit 42 threat research group. Vaultree appointed David Currie, formerly CISO at Nubank and Klarna, as CEO, while Bedrock Security brought on George Gerchow, previously interim CISO at MongoDB, as Chief Security Officer. Phil Venables, former Google Cloud CISO, joined Ballistic Ventures as a Venture Partner. (SecurityWeek)